CVE-2022-31095: Exposure of Sensitive Information to an Unauthorized Actor

discourse-chat is a chat plugin for the Discourse application. Versions prior to 0.4 are vulnerable to an exposure of sensitive information, where an attacker who knows the message ID for a channel they do not have access to can view that message using the chat message lookup endpoint, primarily...

CVE-2022-31300

A cross-site scripting vulnerability in the DM Section component of Haraj v3.7 allows attackers to execute arbitrary web scripts or HTML via a crafted POST request...

CVE-2022-31300

A cross-site scripting vulnerability in the DM Section component of Haraj v3.7 allows attackers to execute arbitrary web scripts or HTML via a crafted POST request...

CVE-2021-4000

creationtimestamp| type| source ---|---|--- 2021-12-03 14:37:39+00:00| seen| https://t.me/cibsecurity/33299...

PSA: Widespread Remote Working Scam Underway

Ive just gotten off the phone with a victim of the scam that Im about to describe. This is impacting a lot of folks, so please do spread the word. Its infuriating. Ill be around to reply to your comments below, but please do not engage in victim-blaming, because until youve actually been hit by o...

Slack hurries to fix direct message flaw that allowed harassment

The enormous work messaging platform Slack quickly reversed course yesterday, promising to revise a brand-new direct message feature that could have been misused for harassment. Added to the company’s “Slack Connect” product—which lets enterprise users share messages with contract workers and...

CVE-2020-14459

An issue was discovered in Mattermost Server before 5.19.0. Attackers can rename a channel and cause a collision with a direct message, aka MMSA-2020-0002...

CVE-2020-14459

An issue was discovered in Mattermost Server before 5.19.0. Attackers can rename a channel and cause a collision with a direct message, aka MMSA-2020-0002...

Code injection

An issue was discovered in Mattermost Server before 5.23.0. Automatic direct message replies allow attackers to cause a denial of service infinite loop, aka MMSA-2020-0020...

Design/Logic Flaw

An issue was discovered in Mattermost Server before 5.19.0. Attackers can rename a channel and cause a collision with a direct message, aka MMSA-2020-0002...

CVE-2019-20844

The CVE-2019-20844 entry applies to Mattermost Server when using versions before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. The documented issue is that an attacker can spoof a direct-message channel by changing the type of a channel. The available sources confirm the affected software and the mi...

CVE-2019-20844

An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. An attacker can spoof a direct-message channel by changing the type of a channel...

CVE-2019-20844

An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. An attacker can spoof a direct-message channel by changing the type of a channel...

CVE-2020-14459

CVE-2020-14459 affects Mattermost Server prior to 5.19.0. The vulnerability allows attackers to rename a channel and cause a collision with a direct message, described across multiple sources (e.g., PT‑2020‑14019). Impact is the potential confusion or misrouting between channel and direct message...

CVE-2020-14448

An issue was discovered in Mattermost Server before 5.23.0. Automatic direct message replies allow attackers to cause a denial of service infinite loop, aka MMSA-2020-0020...

CVE-2020-14459: Improper Input Validation

An issue was discovered in Mattermost Server before 5.19.0. Attackers can rename a channel and cause a collision with a direct message, aka MMSA-2020-0002...

CVE-2018-21254: Incorrect Permission Assignment for Critical Resource

An issue was discovered in Mattermost Server before 5.1. An attacker can bypass intended access control for direct-message channel creation via the Message slash command...

CVE-2019-20844: Improper Enforcement of Message Integrity During Transmission in a Communication Channel

An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. An attacker can spoof a direct-message channel by changing the type of a channel...

CVE-2020-14448: Loop with Unreachable Exit Condition

An issue was discovered in Mattermost Server before 5.23.0. Automatic direct message replies allow attackers to cause a denial of service infinite loop, aka MMSA-2020-0020...

X (Formerly Twitter): Delete direct message history without access the proper conversation_id

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! Summary: add summary of the vulnerabili...